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IN THE CLAIMS 

Please ametid the claims as indicated: 

1. (previously presented) A method of enabling use of a secure password, comprising: 

diudng power up initialization before an operating system is started, copying security data 
ftom an unsecure mesmory device in a computer to a restricted portion of the computer's system 
memory which is invisible to the operating system, wherein the restricted portion of the 
computer's system memory contains code and data needed for low level system control functions 
that are independent of the operating system, and wherein a writing of data into the restricted 
portion of the computer's system memory is authorized only for a trusted software entity that has 
been authenticated as having permission to access the restricted portion of the computer's system 
memory, wherein the trusted software entity is a tm$ted routine that is part of a Basic 
Input/Output System (BIOS) Power-On Self Test (POST) program that is stored in the computer; 
and 

before starting the ope^rating system, hard locking the memory device against direct 
access so that a reset signal is required to unlock the memory device. 

2. (original) The method of claim 1, fiirther comprising: 

responsive to receiving an entered password under the operating system, calling a routine 
executing within the restricted portion of system memory to verify the password; and 

receiving an indication from the routine regarding whether the entered password matched 
a password within the security data copied to the restricted portion of system memory from the 
memory device. 

3. (previously presented) The method of claim 1, wherein the step of copying security data 
from a memory device to a restricted portion of system memory which is invisible to the 
operating system further comprises: 

checking a return address for a call requesting that the security data be copied to verify 
that the call originated with the trusted routine. 
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4. (previously presented) The method of claim 3, wherein the step of checking a return 
address for a call requesting that the security data be copied to verify that the call originated with 
the trusted routine further comprises: 

placing a label within a basic input/output services routine implementing a process for 
copying the security data immediately after iastructions for the call requesting that the security 
data be copied; 

placing an address for the label within code execuhng within the restricted portion of 
sj^tem memory aad checking the return address for the call requesting that the security data be 
copied; 

comparing the return address and the address for the label; 

responsive to detettniaitig that the retum address does not match the address for the labels 
returning a null response to the call requesting that the security data be copied; and 

responsive to determining that the return address matches the address for the label, 
copying the security data to the restricted portion of system memory and resetting a retry 
counter. 

5. (original) The method of claim 1> wherein the step of copying security data j&om a memory 
device to a restricted portion of system memory which is invisible to the operating system further 
comprises: 

copying the password and other sensitive data which requires protection from access 
under the operating system. 

6. (original) The method of claim 1, whereiu the step of copying security data from a memory 
device to a restricted portion of system memory which is invisible to the operating system further 
comprises: 

loading the security data to regular system memory prior to imtiating the call requesting 
that the security data be copied; and 

upon receiving any response to the call requesting that the security data be copied, 
erasing the security data from regular system memory before starting the operating system. 
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7. (previously presented) A method of enabling iise of a secure password, comprising: 

responsive to receiving an entered password under an operating system^ calling a r outine 
executing within a restricted portion of system memory to verify the password, wherein the 
restricted portion of system memory is invisible to the operating system and wherein the 
operating system and routines executing within the restricted portion of system memory 
communicate through a calling convention^ and wherein the restricted portion of the system 
memory contains code and data needed for low level system control functions that are 
independent of the operating system, and wherein a writing of data into the restricted portion of 
the system memory is authorized only for a trusted software entity that has been authenticated as 
having permission to access the restricted portion of the system memory, wherein the trusted 
software entity is a trusted routine in a Basic Input/Output System (BIOS) Power-On Self Test 
(POST) program that is stored in the computer; and 

receiving only an indication from the routine executing within the restricted portion of 
memory regarding whether the entered password matched a password stored within the restricted 
portion of system memory. 

8. (original) The method of claim 7, farther comprising: 

during power up initialization before the operating system is started^ copying a password 
from a memory device to the restricted portion of system memory; and 

before starting the operating system, hard locking the memory device against direct 
access so that a reset signal is required to unlock the memory device, 

9. (original) The method of claim 7, further comprising: 

determining whether a password is required for an operation by checking with the routine 
executing within a restricted portion of system memory to verify existence of a password. 

1 0. (original) The method of claim 7, further comprising: 

limiting a number of retries for a user to reenter a password. 

1 1 . (original) The method of claim 7, further comprising: 
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transmitting the entered password entered by a user to the routine executing within a 
restricted portion of system memory using the calling convention; and 

responsive to receiving an indication fix)m the routine executing within the restricted 
portion of memory that the entered password matched the password stored within the restricted 
portion of system memory, continuing an operation requiring the entered password for executiorL 

12. (previously presented) A data processing system, comprisiag: 

a memory device which may be hard locked against direct access so that a reset signal is 
required to unlock the memory device; and 

a power up initialization routine executing within the data processing system, wherein the 
pow^ up initialization routitie^ before starting an operating system^ copies secxrrity data from the 
memory device in a computer to a restricted portion of the computer's system memory which is 
invisible to the operating system and hard locks the computer's memory device, wherein the 
restricted portion of the computer's system memory contains code and data needed for low level 
system control functions that are independent of the operating system, and whereia a writing of 
data into the restricted portion of the computer^'s system memory is authorized only for a trusted 
software entity that has been authenticated as having permission to access the restricted portion 
of the computer's 53retem memory. 

13. (original) The data processing system of claim 12, wherein the power up initialization 
routine, responsive to receiving an entered password under the operating system, calls a routine 
executing within the restricted portion of system memory to verify the password and receives an 
indication from the routdne regarding whether the entered password matched a password within 
the secxirity data copied to the restricted portion of system memory from the memory device. 

14. (original) The data processing system of claim 13, wherein the routine executing within the 
restricted portion of system memory checks a return address for a call requesting that the security 
data be copied to verify that the call originated with a trusted routine. 

15. (original) The data processing system of claim 13, wherein the power up initialization 
routine, to facilitate checking a return address for a call requesting that the security data be 
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copied to verify that the call origiiiated with a trusted routine, places a label within a basic 
input/output services routine implementing a process for copying the security data iitmaediately 
ajfler instructions for the call requesting that the secxirity data be copied, wherein the routine 
executing within the restricted portion of system raemory contains an address for the label, 
checks the return address for the call requesting that the security data be copied, and compares 
the return address and the address for the label and, responsive to determining that the return 
address does not match the address for the label, returning a null response to the call requesting 
that the security data be copied, and responsive to determining that the return address matches 
the address for the labels copying the security data to the restricted portion of system memory 
and resetting a retry counter. 

16. (original) The data processing system of claim 12, wherein the power up initialization 
routine copies the password and other sensitive data which requires protection firom access tmder 
the operating system. 

17. (original) The data processing system of claim 12, wherein the power up initialization 
routine loads the security data to regular system memory prior to initiating the call requesting 
that the security data be copied and, upon receiving any response to the call requesting that the 
security data be copied, erases the security data from regular system memory before starting the 
operating system. 

18. (previously presented) A data processing system, comprising: 

an operating system; 

a memory device which may be hard locked against direct access so that a reset signal is 
required to unlock the memory device; 

a system memory including a restricted portion invisible to the operating system, wherein 
the operating system and routines executing within the restricted portion of system memory 
communicate ttirough a calling convention; and 

a power up initialization routine executing within the data processing system, wherein the 
power up initialization routine, responsive to receiving an entered password under an operating 
system, calls a routiae executing within a restricted portion of system memory to verify the 
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password, and receives [[only]] an indicatioTi from the routine executing within the restricted 
portion of memory regarding whether the entered password matched a password stored within 
the restricted portion of system memory^ wherein the restricted portion of the system memory 
contains code and data needed for low level system control functions that are independent of the 
operating system, and wherein a writing of data into the restricted portion of the system memory 
is authorized only for a trusted software entity that has been authenticated as having permission 
to access the restricted portion of the system memory, 

19. (original) The data processing system of claim 18, wherein the power up initialization 
routine, during power up initialization before the operattng system is started, copies a password 
flrom the memory device to the restricted portion of system memory and, before starting the 
operating system, hard locks the memory device against direct access so that a reset signal is 
required to unlock the memory device. 

20. (original) The data processing system of claim 18, wherein the power up initialization 
routine determines whether a password is required for an operation by checking with the routine 
executing within a restricted portion of system memory to veriify ejcistence of a password- 

21. (original) The data processing system of claim 18, wherein the routine executing within a 
restricted portion of system memory to verify the password limits a number of retries for a user 
to reenter a password. 

22. (original) The data processing system of claim 18, wherein the power up initialization 
routine transmits the entered password entered by a user to the routine executing within a 
restricted portion of system memory using the calling convention and, responsive to receiving an 
indication from the routine executing within the restricted portion of memory that the entered 
password matched the password stored within the restricted portion of system memory, 
continues an operation requiring the entered password for execution. 

23. (previously presented) A computer program product within a computer usable medium for 
enabling use of a secure password, comprising: 

Page? 

Docket No. KPS920000043US1 - U.S. Patent AppHcation No. 09/711,028 

AjoaendmeEitD 



PAGE 8/12 * RCVD AT 716/2006 9:35:01 AM [Eastern Daylight Time] * SVR:USPT0-EFXIV-2/1 * DNIS:273S300 * CSID:5123436446 * DlHUTiON (inin-ss):0340 



JUL/06/2006/THU 08:33 AM DILLON & YUDELL, LLP FAX No. 5123436446 



P. 009 



instructioTis for copying security data from a memory device in a computer to a restricted 
portion of the computer's system memory which, is invisible to the operating system during 
power up itjitialization before an operating system is started, wberein the restricted portion of the 
computer's system memory contains code and data needed for low level system control functions 
that are independent of the operating system, and wherein a writing of data into the restricted 
portion of the computer's system memory is authorized only for a trusted software entity that has 
been authenticated as having permission to access the restricted portion of the computer's system 
memory; and 

instructions for hard locking the memory device against direct access so that a reset 
signal is required to unlock the memory device before starting the operating system. 

24. (original) The computer program product of claim 23^ further comprising: 

instructions, responsive to receiving an entered password under the operating system, for 
calling a routine executing within the restricted portion of system memory to verify the 
password; and 

instmctions for receiving an indication from the routine regarding whether the ^te^ed 
password matches a password within the security data copied to the restricted portion of system 
memory from the memory device. 

25. (original) The computer program product of claim 23, wherein the instructions for copying 
security data from a memory device to a restricted portion of system memory which is invisible 
to the operating system further comprise: 

instmctions for checking a return address for a call requesting that the security data be 
copied to verify that the call originated with a trusted routiae. 

26. (original) The computer program product of claim 25, wherein the instructions for checking 
a return address for a call requesting that the security data be copied to verify that the call 
originated with a trusted routine farther comprise: 

instructions for placing a label within a basic input/output services routine implementing 
a process for copying the security data immediately after instructions for the call requesting that 
the security data be copied; 
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an address for the label within code executing within the restricted portion of system 
memory and checking the return address for the call requesting that the security data be copied; 

instructions for comparing the return address and the address for the label; 

instmctions, responsive to detenrutJing that the return address does not match the address 
for the-label, for returning a null response to the call requesting that the security data be copied; 
and 

instmctions, responsive to determining that the return address matches the address for the 
label, for copying the security data to. the restricted portion of system memory and resetting a 
retry counter. 

27-29. (cancelled) 

30. (cxjxrently amended) The computer program product of claim [[29]] 23^ wherein the 
restricted portion of the system memory is a System Management latemipt (SMT) memory 
space. 

3 1 . (previously presented) The method of claim 1 , wherein the restricted portion of the system 
memoxy is a System Management Interrupt (SMS) memory space, 

32. (previously presented) The method of claim 7, wherein the restricted portion of the system 
memory is a System Management hiterrupt (SMI) memory space. 

33. (previously presented) The data processing system of claim 12, whereiu the restricted 
portion of the system memory is a System Management Interrupt (SMI) memory space. 

34. (previously presented) A method comprisiog: 

asserting a Power-On Self Test (POST) Basic Input/Output System (BIOS) program in a 
computer; 

in response to the POST BIOS program being asserted, setting a hard lock state on a non- 
volatile memory that contains sensitive data; 
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in response to the POST BIOS program being asserted, pennitting an execution of a 
reading of the sensitive data in the non-volatile memory; 

loading the sensitive data from the non-volatile memory into a non-protected system 
memory in the computer; and 

in response to a call to code in a System Memory Interrupt (SMI) memory space, using 
the code in the SMI memory space to move the sensitive data from the non-protected system 
memory to the SMI memory space. 

35. (previously presented) The method of claim 34, wherein the move of sensitive data from 
the non-protected system to the SMI memory space is permitted only if the call is a first request 
to copy the sensitive data from the non-protected system memory to the SMI memory space. 

36. (previously presented) The method of claim 34, ftirther comprising: 

appending a label to a source code in the BIOS POST program, wherein the source code 
calls the code in the SMI memory space, and wherein the label contains an address of the source 
code; 

checking on a stack a return address for the source code when the source code calls the 
code in the SMI memory space; 

comparing the return address on the stack with the address in the label for the source 
code; and 

storing the sensitive data from the non-protected system memory to the SMI memory 
space only in response to determining that the address on the stack is the same as the address in 
the label for the soxirce code. 
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